Authorization deny anonymous and running locally doesn’t load stylesheet for login page

A developer I know ran into this situation that he built this simple app with default page and login page. He has lot of data files that the default page servers but he wanted to limit the access to only authorized users. Suggested him to look into the built in authentication and authorization modules and it worked fine on the server by setting the authorization as:

<authorization>

<deny users="?"/>

<allow users="*"/>

</authorization>

However, when he ran the app from visual studio, locally, the login page doesn't load the stylesheets or any images. Took me couple of seconds to realize that the difference is when he runs locally, all the files including images and styles are served by the built in dev server which applies the authorization rules to every file. And hence the styles and images are not loaded.

Typically, we design the default page and login pages with no authorization and so may not realize this issue. But when we get into such situation, the solutions could be quite simple too. Either pick the files and/or folders to authorize and apply to them only. Or, exclude generic folders like images and styles. For example,

<location path="images">

<system.web>

<authorization>

<allow users="*"/>

</authorization>

</system.web>

</location>

Love coding!